prototype-html
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill generates HTML files that reference external resources from well-known providers, specifically Tailwind CSS via
cdn.tailwindcss.comand Font Awesome viacdnjs.cloudflare.com. Both are widely used and established service providers. - [DYNAMIC_EXECUTION]: The skill's primary function is to generate HTML files containing embedded JavaScript for UI interactions, such as modal management and SVG line drawing for feature annotations, based on the provided example template.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user requirements to populate the generated prototype. While it uses internal templates, there are no instructions to sanitize user-provided data before it is interpolated into the generated HTML structure, creating a surface for potential injection.
- Ingestion points: User requirement descriptions provided at runtime via the prompt.
- Boundary markers: None specified in the instructions to separate user input from the rest of the HTML template.
- Capability inventory: Generates HTML files with embedded JavaScript based on
assets/example.html. - Sanitization: No explicit validation or escaping of user input is instructed in
SKILL.md.
Audit Metadata